<html>
<head><meta charset="utf-8"><title>ffi safety · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html">ffi safety</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="146796053"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/146796053" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#146796053">(Nov 05 2018 at 13:47)</a>:</h4>
<p>C FFI only makes sense if there is a platform to interface with, and multiple discussions about layout are "tangentially" imposing requirements on this platform. I think it would make sense to open an issue about what's the platform (how do we define it, do we talk about valid and invalid platforms), its role in Rust (a platform is optional, but if there is one, it must be valid, its role with C FFI, extern "C", repr(C), ...), and the specification of valid platforms.</p>



<a name="147477657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147477657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147477657">(Nov 11 2018 at 13:31)</a>:</h4>
<p>I've sent a PR documenting the bare minimum requirements on the C implementation of the target platform: <a href="https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46" target="_blank" title="https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46">https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46</a></p>



<a name="147477699"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147477699" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147477699">(Nov 11 2018 at 13:33)</a>:</h4>
<p>There are still some critical unresolved questions open, but I think it is ok to gather consensus on the least controversial issues first, and if required, open new issues to discuss each of the unresolved questions on its own.</p>



<a name="147479108"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147479108" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147479108">(Nov 11 2018 at 14:23)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> to what end are you avoiding defining the values of bool?</p>



<a name="147479256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147479256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147479256">(Nov 11 2018 at 14:29)</a>:</h4>
<p>oops, to no end, that was an oversight</p>



<a name="147479416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147479416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147479416">(Nov 11 2018 at 14:34)</a>:</h4>
<p>I also haven't actually seen any resistance to the notion that, if floats are present, they surely must be IEEE-754 binary</p>



<a name="147479435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147479435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147479435">(Nov 11 2018 at 14:35)</a>:</h4>
<p>but i'm fuzzy on exactly what we want our story here to be</p>



<a name="147480630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480630">(Nov 11 2018 at 15:17)</a>:</h4>
<p>I think <span class="user-mention" data-user-id="124289">@rkruppe</span> had some thoughts about what exactly can we guarantee there</p>



<a name="147480679"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480679" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480679">(Nov 11 2018 at 15:19)</a>:</h4>
<p>I do? Well I did curse myself with floating point and C standard knowledge but I don't recall commenting on this specifically</p>



<a name="147480732"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480732" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480732">(Nov 11 2018 at 15:21)</a>:</h4>
<p>haha</p>



<a name="147480773"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480773" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480773">(Nov 11 2018 at 15:22)</a>:</h4>
<p>I think the most relevant parties for optional floats are kernel-mode devs who want to ensure floating point registers aren't touched</p>



<a name="147480789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480789">(Nov 11 2018 at 15:23)</a>:</h4>
<p>Disabling the float types is neither necessary (can just use soft floats) nor sufficient (if you don't use floats, llvm can and often will still use those registers) for that</p>



<a name="147480837"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147480837" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147480837">(Nov 11 2018 at 15:25)</a>:</h4>
<p>and even if we add a "no floats" mode for whatever reason, I think it can just be an implementation-defined option which makes it questionable whether we want to include it in "what Rust requires from the C platform"</p>



<a name="147481439"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147481439" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147481439">(Nov 11 2018 at 15:47)</a>:</h4>
<p>If we were to have a mode that makes f32/f64 software-defined, that does have interesting ABI implications (are they now passed as ints? what does this mean for C FFI)</p>



<a name="147481447"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147481447" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147481447">(Nov 11 2018 at 15:47)</a>:</h4>
<p>But yes I was assuming some kind of hard no-floats mode that tells llvm to stay away</p>



<a name="147486640"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486640" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486640">(Nov 11 2018 at 18:35)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> <code>_Bool</code>, not <code>Bool_</code>.</p>



<a name="147486686"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486686" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486686">(Nov 11 2018 at 18:36)</a>:</h4>
<p>thanks, fixed</p>



<a name="147486688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486688">(Nov 11 2018 at 18:36)</a>:</h4>
<p>also, "have, at least, one pointer value that is never dereferenceable" is too strong.</p>



<a name="147486693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486693">(Nov 11 2018 at 18:36)</a>:</h4>
<p>in theory, you could dereference a value which is equal to null, it's just that rust references will not represent it.</p>



<a name="147486700"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486700" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486700">(Nov 11 2018 at 18:37)</a>:</h4>
<p><span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> Option&lt;&amp;T&gt; is a pointer in FFI</p>



<a name="147486706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486706">(Nov 11 2018 at 18:37)</a>:</h4>
<p>in particular, a C FFI ABI function can return an <code>Option&lt;&amp;T&gt;</code>, which has to be <code>None</code> if the pointer is not valid</p>



<a name="147486756"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486756" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486756">(Nov 11 2018 at 18:38)</a>:</h4>
<p>C FFI is unsound, so I guess it doesn't really matter whether the <code>Option</code> is <code>None</code> when the C pointer is valid..</p>



<a name="147486760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486760">(Nov 11 2018 at 18:38)</a>:</h4>
<p>correct</p>



<a name="147486762"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486762" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486762">(Nov 11 2018 at 18:38)</a>:</h4>
<p>C requires a "null pointer value"</p>



<a name="147486766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486766">(Nov 11 2018 at 18:39)</a>:</h4>
<p>a null pointer constant</p>



<a name="147486771"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486771" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486771">(Nov 11 2018 at 18:39)</a>:</h4>
<p>no, null pointer value.</p>



<a name="147486772"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486772" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486772">(Nov 11 2018 at 18:39)</a>:</h4>
<p>there might not be a run-time way to detect a null pointer</p>



<a name="147486778"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486778" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486778">(Nov 11 2018 at 18:39)</a>:</h4>
<p>ah well, that doesn't make sense</p>



<a name="147486779"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486779" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486779">(Nov 11 2018 at 18:39)</a>:</h4>
<p><code>void* x = 0;</code> &lt;- x has a null pointer value.</p>



<a name="147486825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486825">(Nov 11 2018 at 18:40)</a>:</h4>
<p>if you initialize an object of pointer type with either 1) a null pointer value, or 2) a null pointer constant, it has a null pointer value</p>



<a name="147486832"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486832" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486832">(Nov 11 2018 at 18:40)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="kt">void</span><span class="o">*</span> <span class="n">x</span> <span class="o">=</span> <span class="cm">/* null pointer constant: */</span> <span class="p">(</span><span class="kt">void</span><span class="o">*</span><span class="p">)</span><span class="mi">0</span><span class="p">;</span>
<span class="n">assert</span><span class="p">(</span><span class="n">x</span> <span class="o">==</span> <span class="nb">NULL</span><span class="p">);</span> <span class="c1">// can fail</span>
</pre></div>



<a name="147486834"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486834" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486834">(Nov 11 2018 at 18:41)</a>:</h4>
<p>nope</p>



<a name="147486842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486842">(Nov 11 2018 at 18:41)</a>:</h4>
<p>wait, i messed that up</p>



<a name="147486882"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486882" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486882">(Nov 11 2018 at 18:42)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="kt">void</span><span class="o">*</span> <span class="n">x</span> <span class="o">=</span> <span class="cm">/* null pointer constant: */</span> <span class="p">(</span><span class="kt">void</span><span class="o">*</span><span class="p">)</span><span class="mi">0</span><span class="p">;</span>
<span class="kt">int</span> <span class="n">y</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="n">assert</span><span class="p">(</span><span class="n">x</span> <span class="o">==</span> <span class="p">(</span><span class="kt">void</span><span class="o">*</span><span class="p">)</span><span class="n">y</span><span class="p">);</span> <span class="c1">// can fail</span>
</pre></div>



<a name="147486886"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486886" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486886">(Nov 11 2018 at 18:42)</a>:</h4>
<p>yes</p>



<a name="147486888"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486888" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486888">(Nov 11 2018 at 18:42)</a>:</h4>
<p>but <code>y</code> is not a null pointer constant</p>



<a name="147486889"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486889" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486889">(Nov 11 2018 at 18:42)</a>:</h4>
<p>no, i see what you mean now</p>



<a name="147486890"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486890" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486890">(Nov 11 2018 at 18:42)</a>:</h4>
<p>and therefore, <code>(void*)y</code> may have a non-null-pointer-value</p>



<a name="147486892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486892">(Nov 11 2018 at 18:42)</a>:</h4>
<p>so C already requires a null pointer value</p>



<a name="147486893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486893">(Nov 11 2018 at 18:42)</a>:</h4>
<p>yeah</p>



<a name="147486896"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486896" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486896">(Nov 11 2018 at 18:43)</a>:</h4>
<p>so we don't have to say anything then</p>



<a name="147486900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486900">(Nov 11 2018 at 18:43)</a>:</h4>
<p>it may be implementation defined to be dereferenceable</p>



<a name="147486901"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486901" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486901">(Nov 11 2018 at 18:43)</a>:</h4>
<p>but that's just turning UB into defined behavior</p>



<a name="147486902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486902">(Nov 11 2018 at 18:43)</a>:</h4>
<p>which is totally allowable</p>



<a name="147486903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486903">(Nov 11 2018 at 18:43)</a>:</h4>
<p>I think the real question is whether we require NULL to be 0, and if not, whether we ensure that Option&lt;&amp;T&gt;::None == c_null</p>



<a name="147486905"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486905" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486905">(Nov 11 2018 at 18:43)</a>:</h4>
<p>yeah</p>



<a name="147486907"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486907" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486907">(Nov 11 2018 at 18:43)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> the question is whether  the case above, cannot fail</p>



<a name="147486946"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486946" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486946">(Nov 11 2018 at 18:44)</a>:</h4>
<p>I think it's reasonable to say "rustc only supports platforms with <code>(intptr_t)(void*)NULL = 0</code>"</p>



<a name="147486948"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486948" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486948">(Nov 11 2018 at 18:44)</a>:</h4>
<p>but leave open other implementations that may want <code>(intptr_t)(void*)NULL ≠ 0</code></p>



<a name="147486949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486949">(Nov 11 2018 at 18:44)</a>:</h4>
<p>I just don't think it's a usecase that anybody cares about</p>



<a name="147486950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486950">(Nov 11 2018 at 18:44)</a>:</h4>
<p>That's a very uh, subtle, spec</p>



<a name="147486951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486951">(Nov 11 2018 at 18:45)</a>:</h4>
<p>The issue was, what if a C platform has <code>(intptr_t)(void*)NULL = 0xfffff</code> ?</p>



<a name="147486957"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486957" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486957">(Nov 11 2018 at 18:45)</a>:</h4>
<p>Should we try or try not to support those?</p>



<a name="147486958"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486958" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486958">(Nov 11 2018 at 18:45)</a>:</h4>
<p>ubsan is proposing not supporting them <em>in rustc</em> but allowing other implementations to support it</p>



<a name="147486961"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486961" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486961">(Nov 11 2018 at 18:45)</a>:</h4>
<p>because LLVM's backend doesn't support them, specifically</p>



<a name="147486962"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147486962" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147486962">(Nov 11 2018 at 18:45)</a>:</h4>
<p>and also because rustc isn't on any platforms where it's necessary</p>



<a name="147487002"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487002" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487002">(Nov 11 2018 at 18:46)</a>:</h4>
<p>oh that's pretty compelling, if llvm hasn't needed to support it</p>



<a name="147487005"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487005" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487005">(Nov 11 2018 at 18:46)</a>:</h4>
<p>we just said that <code>Option&lt;&amp;T&gt;</code> on FFI is unsound, no matter what we do,</p>



<a name="147487006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487006">(Nov 11 2018 at 18:46)</a>:</h4>
<p>??</p>



<a name="147487010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487010">(Nov 11 2018 at 18:46)</a>:</h4>
<p>FFI is intrinsically unsound</p>



<a name="147487011"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487011" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487011">(Nov 11 2018 at 18:46)</a>:</h4>
<p>yeah, I don't think clang nor gcc support platforms where the null pointer value is not all zeroes</p>



<a name="147487013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487013">(Nov 11 2018 at 18:47)</a>:</h4>
<p>and I know MSVC doesn't</p>



<a name="147487028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487028">(Nov 11 2018 at 18:47)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> that's like saying "transmute is inherently unsound"</p>



<a name="147487029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487029">(Nov 11 2018 at 18:47)</a>:</h4>
<p>I mean, yes, it is</p>



<a name="147487030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487030">(Nov 11 2018 at 18:47)</a>:</h4>
<p>but only given no context</p>



<a name="147487031"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487031" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487031">(Nov 11 2018 at 18:47)</a>:</h4>
<p>not helpful i know</p>



<a name="147487033"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487033" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487033">(Nov 11 2018 at 18:47)</a>:</h4>
<p>the question is, how do we word this ?</p>



<a name="147487072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487072">(Nov 11 2018 at 18:48)</a>:</h4>
<p>I feel like we already have <code>unsafe</code> for this notion..?</p>



<a name="147487073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487073">(Nov 11 2018 at 18:48)</a>:</h4>
<p>I can just delete the requirement</p>



<a name="147487074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487074">(Nov 11 2018 at 18:48)</a>:</h4>
<p>yeah, that's how I'd do it</p>



<a name="147487076"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487076" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487076">(Nov 11 2018 at 18:48)</a>:</h4>
<p>and just define <code>Option&lt;&amp;T&gt;::None</code> to be bit-pattern compatible with <code>std::ptr::null()</code></p>



<a name="147487077"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487077" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487077">(Nov 11 2018 at 18:49)</a>:</h4>
<p>Option&lt;&amp;T&gt; in rust uses 0x0 to denote a null pointer, whether that's guaranteed to always work or not has nothing to do with the platform so it doesn't belong there</p>



<a name="147487084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487084">(Nov 11 2018 at 18:49)</a>:</h4>
<p>huh?</p>



<a name="147487086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487086">(Nov 11 2018 at 18:49)</a>:</h4>
<p>that seems incredibly related to platform</p>



<a name="147487087"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487087" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487087">(Nov 11 2018 at 18:49)</a>:</h4>
<p>Exactly, last time i told <span class="user-mention" data-user-id="137587">@Gankro</span> that we should make <code>ptr::is_null()</code> the only way to test for null-pointerness</p>



<a name="147487130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487130">(Nov 11 2018 at 18:50)</a>:</h4>
<p>Being able to write portable and correct FFI code is a key part of defining the platform</p>



<a name="147487131"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487131" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487131">(Nov 11 2018 at 18:50)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> if C returns 0x0 to denote a valid address, the Option&lt;&amp;T&gt; would be None in the rust side, (or maybe not, if we set none to something else)</p>



<a name="147487133"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487133" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487133">(Nov 11 2018 at 18:50)</a>:</h4>
<p>but that's it, on the rust side you can transmute Option&lt;&amp;T&gt; to a *const T and do whatever you want</p>



<a name="147487137"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487137" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487137">(Nov 11 2018 at 18:50)</a>:</h4>
<p>if C returns a null pointer value to denote a valid address, then the return type of that function in Rust should be <code>*const|mut T</code></p>



<a name="147487144"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487144" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487144">(Nov 11 2018 at 18:51)</a>:</h4>
<p>which poses another good question, when a C pointer compares true with <code>NULL</code>, should the Rust raw pointer with the same representation also return <code>is_null()</code> true ?</p>



<a name="147487145"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487145" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487145">(Nov 11 2018 at 18:51)</a>:</h4>
<p>Right in some sense it's the burden of the FFI bindings to capture the API</p>



<a name="147487187"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487187" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487187">(Nov 11 2018 at 18:52)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> what other semantics make sense? also, s/compares true/compares equal/</p>



<a name="147487190"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487190" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487190">(Nov 11 2018 at 18:53)</a>:</h4>
<p>I would be very happy with defining that, I don't super care about someone making a rustc for some wild platform that none of llvm/gcc/msvc even support</p>



<a name="147487195"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487195" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487195">(Nov 11 2018 at 18:53)</a>:</h4>
<p>Well, that means that the bitpattern that Option&lt;&amp;T&gt; uses to denote null has to match the one that the platform uses</p>



<a name="147487198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487198">(Nov 11 2018 at 18:53)</a>:</h4>
<p>because it would be sane to transmute a null Rust pointer to Option&lt;&amp;T&gt; and expect it to be None</p>



<a name="147487199"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487199" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487199">(Nov 11 2018 at 18:53)</a>:</h4>
<p>that's what I said</p>



<a name="147487200"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487200" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487200">(Nov 11 2018 at 18:53)</a>:</h4>
<p>ok, so i'll remove the sentence</p>



<a name="147487240"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487240" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487240">(Nov 11 2018 at 18:54)</a>:</h4>
<p>i think that once we go to the validity discussion, we have to define the bitpattern for which Option&lt;&amp;T&gt; is none - that's not part of the layout discussion AFAICT</p>



<a name="147487241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487241">(Nov 11 2018 at 18:54)</a>:</h4>
<p>The existence of ptr::as_ref more or less guarantees that null is None</p>



<a name="147487242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487242">(Nov 11 2018 at 18:55)</a>:</h4>
<p>It might make sense to have a lang "constant" specifying this bit pattern, to specify that ptr.is_null() is the only way to test null ptr constness, or comparing against this bit pattern, etc.</p>



<a name="147487252"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487252" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487252">(Nov 11 2018 at 18:55)</a>:</h4>
<p>we can probably lint if people use something else than ptr.is_null() to do "null pointer checks"</p>



<a name="147487256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487256">(Nov 11 2018 at 18:55)</a>:</h4>
<p>wait I feel like we're backsliding why do we want to support non-zero-bits-null again</p>



<a name="147487344"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487344" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487344">(Nov 11 2018 at 18:58)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> to not prevent it from existing, if someone wants to go to the trouble</p>



<a name="147487354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487354">(Nov 11 2018 at 18:59)</a>:</h4>
<p>So i've pushed the commit to the PR. It removes the requirement, and adds it as an unresolved question to clarify when we start discussing validity.</p>



<a name="147487456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487456">(Nov 11 2018 at 19:00)</a>:</h4>
<p>I agree with <span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> that we should support this, because it takes little work to do so. If the conclusion of validity is that we only support platforms where runtime <code>0x0</code> is a null pointer, we'd have to add this requirement to the list.</p>



<a name="147487518"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487518" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487518">(Nov 11 2018 at 19:03)</a>:</h4>
<p>hrm, is this the first instance of implementation-defined behaviour we are explicitly introducing, with the intent that someone can write another implementation that explicitly defines this behaviour?</p>



<a name="147487564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147487564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147487564">(Nov 11 2018 at 19:04)</a>:</h4>
<p>also I forget did either of you have a platform in mind where someone would do this?</p>



<a name="147488209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488209">(Nov 11 2018 at 19:27)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> the value of the bit pattern would be unspecified, and required to match the null pointer representation of C only if C FFI is available. I'd suppose that we would "somehow" expose the bitpattern in core, e.g. via a <code>const</code>, and that the correct way of checking the null bitpattern would just be to use the constant. <code>ptr::is_null()</code> would do that for you.</p>



<a name="147488254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488254">(Nov 11 2018 at 19:28)</a>:</h4>
<p>All code that checks for the null bit-pattern in some other way wouldn't be portable, but it wouldn't be incorrect either as long as these match.</p>



<a name="147488261"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488261" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488261">(Nov 11 2018 at 19:29)</a>:</h4>
<p>We could and should add lints for non-portable code, and maybe miri could help here somehow (e.g. by being able to set this bitpattern to some random value), but since miri can call into C FFI, i don't think it would be feasible to somehow convert bitpatterns across C FFI in miri, so i don't know how much software would be testable this way.</p>



<a name="147488529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488529">(Nov 11 2018 at 19:37)</a>:</h4>
<p>how is it possible for someone to make an aligned non-null pointer in a portable way under this model</p>



<a name="147488534"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488534" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488534">(Nov 11 2018 at 19:37)</a>:</h4>
<p>I guess "use NonNull::dangling"</p>



<a name="147488582"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488582" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488582">(Nov 11 2018 at 19:38)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> yeah, <code>NonNull::dangling</code> is correct, imo. Also, I don't believe it's the first example of impl-def behavior?</p>



<a name="147488591"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488591" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488591">(Nov 11 2018 at 19:39)</a>:</h4>
<p>yeah but all other impl-defined behaviour i'm aware is just like "shrug emoji we won't do something awful"</p>



<a name="147488595"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488595" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488595">(Nov 11 2018 at 19:39)</a>:</h4>
<p>and not "this is so someone can write a compiler that does define it"</p>



<a name="147488596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488596">(Nov 11 2018 at 19:39)</a>:</h4>
<p>hrmm.</p>



<a name="147488661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488661">(Nov 11 2018 at 19:41)</a>:</h4>
<p>to be clear: I think the former is a reasonable stance to take on nasty problems we can't solve in a satisfactory way, while the latter is a weird portability/fragmentation thing</p>



<a name="147488707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488707">(Nov 11 2018 at 19:42)</a>:</h4>
<p>or to put it another way, I like unspecified/implementation-defined as a way to have soft UB</p>



<a name="147488713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488713">(Nov 11 2018 at 19:43)</a>:</h4>
<p>I don't like impl-def for soft UB. unspecified, sure</p>



<a name="147488718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488718">(Nov 11 2018 at 19:43)</a>:</h4>
<p>impl-def should be for actual implementation differences</p>



<a name="147488719"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488719" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488719">(Nov 11 2018 at 19:43)</a>:</h4>
<p>like <code>size_of::&lt;usize&gt;()</code></p>



<a name="147488775"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488775" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488775">(Nov 11 2018 at 19:45)</a>:</h4>
<p>usize is a bit weird because I can't imagine writing a rust compiler that isn't consistent with rustc on a given platform?</p>



<a name="147488786"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488786" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488786">(Nov 11 2018 at 19:45)</a>:</h4>
<p>whereas impl-defined seems to suggest that's "the point"</p>



<a name="147488919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147488919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147488919">(Nov 11 2018 at 19:49)</a>:</h4>
<p>as in, i read impl-defined as "there is an interesting tradeoff here that reasonable implementations could differ on" and not "there exist different platforms where this must be different, but all reasonable implementations would agree on any given platform"</p>



<a name="147489035"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147489035" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147489035">(Nov 11 2018 at 19:53)</a>:</h4>
<p>hrm I am confusing myself</p>



<a name="147489037"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147489037" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147489037">(Nov 11 2018 at 19:53)</a>:</h4>
<p>my 2 cents on NULL:<br>
1. address 0 being dereferenceable without UB is something some people want (e.g. the linux kernel) and that LLVM will likely gain support for at some point, but as others already argued above in such a context rust just can't correctly use Option&lt;&amp;T&gt; for a nullable-but-otherwise-valid pointer, which is that rust code's problem.<br>
2. but i haven't seen any use case for ptr::null being different from address zero and causes additional headaches beyond address 0 being dereferenceable so i'd be inclined to not support it</p>



<a name="147515084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147515084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147515084">(Nov 12 2018 at 09:40)</a>:</h4>
<p>To allow this, we don't have to require anything on the C platform, which is what the current PR does. We just have to require that <code>Option&lt;&amp;T&gt;::None</code>'s bit-pattern is all zeros. This does not mean that you can't C FFI with a platform where null pointers have some other bit representation, only that when interfacing with such a platform you might not want to use <code>Option&lt;&amp;T&gt;::None</code> or <code>*[const,mut]::is_null()</code> to check for "non-dereferenceable". One could implement a <code>Ptr&lt;T&gt;</code> type that provides an <code>is_null()</code> that does something else though (or wrap the platform with something that "converts" null pointer representations). If we require that the null address of the C platform to be all zeros, and that this must mean that the pointer is not dereferenceable, that would just mean that one cannot do C FFI with such a platform at all.</p>
<p>So while I think that requiring <code>Option&lt;&amp;T&gt;::None</code> to be all zeros buys us some simplicity on the Rust side, requiring this to hold in C doesn't really buy us anything. It just prevent us from interfacing with platforms where this does not hold.</p>



<a name="147515497"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147515497" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147515497">(Nov 12 2018 at 09:49)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> we assume in our interaction with LLVM that null pointers are 0x0</p>



<a name="147515555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147515555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147515555">(Nov 12 2018 at 09:50)</a>:</h4>
<p>so it is true that that's not really a C platform requirement... it's a requirement to be able to compile and run Rust code <em>at all</em>, whether it does C FFI or not</p>



<a name="147515592"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147515592" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147515592">(Nov 12 2018 at 09:51)</a>:</h4>
<p>Hence what you said about "when interface with such a platform" is hypothetical.</p>



<a name="147515596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147515596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147515596">(Nov 12 2018 at 09:51)</a>:</h4>
<p>Also I think this is worth stating in the C platform requirements because that's a place where people might look for such things.</p>



<a name="147516389"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516389" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516389">(Nov 12 2018 at 10:10)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> <span class="user-mention" data-user-id="124289">@rkruppe</span> said:</p>
<blockquote>
<p>1. address 0 being dereferenceable without UB is something some people want (e.g. the linux kernel) and that LLVM will likely gain support for at some point,</p>
</blockquote>
<p>Rust is already used to build Linux kernel modules, so this is a use case that we definitely want to support.</p>



<a name="147516647"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516647" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516647">(Nov 12 2018 at 10:17)</a>:</h4>
<p>true, but that has naught to do with what I said :)</p>



<a name="147516690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516690">(Nov 12 2018 at 10:18)</a>:</h4>
<p>I am talking about the case where the platform has a NULL ptr but that NULL ptr is not 0x0</p>



<a name="147516699"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516699" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516699">(Nov 12 2018 at 10:18)</a>:</h4>
<p>that is a case LLVM does not support and is not likely to support, so the same goes for Rust</p>



<a name="147516725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516725">(Nov 12 2018 at 10:19)</a>:</h4>
<p>OTOH, you are talking about the case where the platform has no NULL ptr -- no ptr that is NEVER going to be inbounds -- at all. That is a different situation.</p>



<a name="147516820"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147516820" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147516820">(Nov 12 2018 at 10:21)</a>:</h4>
<p>I agree there are valid usecases for that. but it can still simplify things to assume that <em>if</em> a platform has a NULL ptr, then it is 0x0.</p>



<a name="147517075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147517075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147517075">(Nov 12 2018 at 10:27)</a>:</h4>
<p>Ah gotcha. I'm going to add that as an unresolved question to the PR <span class="user-mention" data-user-id="120791">@RalfJ</span> , since I think it is worth opening an issue about this, and discussing it in more depth.</p>



<a name="147517328"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147517328" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147517328">(Nov 12 2018 at 10:32)</a>:</h4>
<p>I've sent a new commit with this differentiation.</p>



<a name="147520306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147520306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147520306">(Nov 12 2018 at 11:38)</a>:</h4>
<p>I've cleaned up the unresolved questions even further</p>



<a name="147532441"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147532441" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147532441">(Nov 12 2018 at 15:34)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> this is, I think, a place where "what rustc supports" and "what rust supports" can be distinct</p>



<a name="147532463"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147532463" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147532463">(Nov 12 2018 at 15:35)</a>:</h4>
<p>I just don't think defining null to be all zero bit pattern actually gains us much</p>



<a name="147532477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147532477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147532477">(Nov 12 2018 at 15:35)</a>:</h4>
<p>in terms of spec simple-ness</p>



<a name="147532490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147532490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147532490">(Nov 12 2018 at 15:35)</a>:</h4>
<p><span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> fair enough. IIRC <span class="user-mention" data-user-id="124289">@rkruppe</span> had some concerns about other bit patterns.</p>



<a name="147532760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147532760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147532760">(Nov 12 2018 at 15:39)</a>:</h4>
<p>i can talk the most about why it would be bad to support in rustc. it's true that this doesn't have to mean anything for the rust language spec, but conversely, if there are no plausible implementations or targets where that would be necessary (and i don't know of any) then leaving it implementation-defined just declares a lot of programs non-portable without any benefit</p>



<a name="147533008"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147533008" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147533008">(Nov 12 2018 at 15:43)</a>:</h4>
<p>also even if ptr::null doesn't give you The Null Pointer Value you can write Rust code that interops with C that uses a different address as Null Pointer Value: address 0 is dereferencable and address &lt;whatever NULL is&gt; happens to always be an invalid pointer without being The Null Pointer Value.</p>



<a name="147533195"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147533195" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147533195">(Nov 12 2018 at 15:45)</a>:</h4>
<p>(the last part means you can't justify some optimizations from Rust semantics, though I think you could still do most of them if you knew you were targeting a platform where that address is never allocated, and honestly optimization power on such a weird platform is not high on my list of priorities)</p>



<a name="147533211"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147533211" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147533211">(Nov 12 2018 at 15:45)</a>:</h4>
<p>that seems unnecessarily weird?</p>



<a name="147533281"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147533281" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147533281">(Nov 12 2018 at 15:46)</a>:</h4>
<p>oh, no, I see where you're going with that</p>



<a name="147539586"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147539586" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147539586">(Nov 12 2018 at 17:33)</a>:</h4>
<p>I think we should open an issue about this once we move to validity of references, etc.</p>



<a name="147552381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552381">(Nov 12 2018 at 21:30)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> isn't CUDA C an extension of C ?<br>
My point was only that NVPTX is a target that we support today, and that AFAICT cannot do FFI with C.</p>



<a name="147552396"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552396" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552396">(Nov 12 2018 at 21:30)</a>:</h4>
<p>It can do FFI with CUDA C, or CUDA C++, but not with "just C".</p>



<a name="147552416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552416">(Nov 12 2018 at 21:31)</a>:</h4>
<p>It might be that there's a variant that applies the same extensions to C, idk for sure</p>



<a name="147552423"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552423" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552423">(Nov 12 2018 at 21:31)</a>:</h4>
<p>I see your point that, because CUDA C is an extension of C, then it includes C. But I don't think that you can do everything that you are allowed to do in C inside a CUDA __device__ kernel.</p>



<a name="147552475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552475">(Nov 12 2018 at 21:32)</a>:</h4>
<p>hm it's true that <em>device</em> code isn't a superset of normal C, certainly not on old compute capabilities. but does that have any bearing on ABI matters?</p>



<a name="147552478"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552478" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552478">(Nov 12 2018 at 21:32)</a>:</h4>
<p>maybe if function pointers didn't exist in CUDA 1.0?</p>



<a name="147552480"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552480" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552480">(Nov 12 2018 at 21:32)</a>:</h4>
<p>CUDA C is really odd</p>



<a name="147552485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552485">(Nov 12 2018 at 21:32)</a>:</h4>
<p>it's definitely not a superset, unlike objective C</p>



<a name="147552486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552486">(Nov 12 2018 at 21:32)</a>:</h4>
<p>Nono, this only impacts that being able to do <code>extern "C"</code> is optional</p>



<a name="147552495"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552495" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552495">(Nov 12 2018 at 21:33)</a>:</h4>
<p>as in, we do not require a platform to allow doing C FFI</p>



<a name="147552502"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552502" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552502">(Nov 12 2018 at 21:33)</a>:</h4>
<p>would it be optional as in, your <code>extern "C"</code> doesn't compile?</p>



<a name="147552509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552509">(Nov 12 2018 at 21:33)</a>:</h4>
<p>yes, the program is illegal</p>



<a name="147552556"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552556" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552556">(Nov 12 2018 at 21:34)</a>:</h4>
<p>if there is no C to FFI with, what should <code>extern "C"</code> do ?</p>



<a name="147552558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552558">(Nov 12 2018 at 21:34)</a>:</h4>
<p>then it seems like it'd be reasonable to say "CUDA Rust", distinct from normal Rust</p>



<a name="147552563"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552563" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552563">(Nov 12 2018 at 21:34)</a>:</h4>
<p>it is</p>



<a name="147552573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552573">(Nov 12 2018 at 21:34)</a>:</h4>
<p>i.e., don't worry about it</p>



<a name="147552577"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552577" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552577">(Nov 12 2018 at 21:34)</a>:</h4>
<p>hm , damn, you got me</p>



<a name="147552584"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552584" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552584">(Nov 12 2018 at 21:34)</a>:</h4>
<p>just like the standards committee doesn't worry about CUDA C++</p>



<a name="147552596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552596">(Nov 12 2018 at 21:35)</a>:</h4>
<p>except insofar as they're LLVM devs who have CUDA in tree</p>



<a name="147552609"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552609" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552609">(Nov 12 2018 at 21:35)</a>:</h4>
<p><code>extern "C"</code> being straight up disallowed feels wild to me, since despite the name it's mostly about the target's default ABI, which just usually/always happens to be C (+ extensions + aspects that are non-conforming)</p>



<a name="147552655"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552655" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552655">(Nov 12 2018 at 21:36)</a>:</h4>
<p>one of the main reasons we are stretching things to leave e.g. the bit representation of NULL undefined, is to not making creating these "dialects" impossible</p>



<a name="147552658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552658">(Nov 12 2018 at 21:36)</a>:</h4>
<p>especially since you can also write it as just <code>extern fn ...</code></p>



<a name="147552699"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552699" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552699">(Nov 12 2018 at 21:37)</a>:</h4>
<p>Should I move the C standard conformance part to an unresolved question ?</p>



<a name="147552704"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552704" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552704">(Nov 12 2018 at 21:37)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> point that we only need the C standard pieces required for FFI makes sense to me.</p>



<a name="147552709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552709">(Nov 12 2018 at 21:38)</a>:</h4>
<p>hmm</p>



<a name="147552751"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552751" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552751">(Nov 12 2018 at 21:38)</a>:</h4>
<p>maybe <code>extern "C"</code> is just conditionally supported</p>



<a name="147552764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552764">(Nov 12 2018 at 21:38)</a>:</h4>
<p>I think it's fine to base everything we say on C and instead leave specifically the handling of targets without standard C implementation as the unresolved question</p>



<a name="147552771"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552771" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552771">(Nov 12 2018 at 21:38)</a>:</h4>
<p>like, there's a Rust which is supported by normal Rust implementations, and then we subset it for "valid Rust implementations which don't implement the full spec"</p>



<a name="147552782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552782">(Nov 12 2018 at 21:39)</a>:</h4>
<p>i.e., <code>extern "C"</code> probably doesn't make a lot of sense for interpreters</p>



<a name="147552794"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552794" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552794">(Nov 12 2018 at 21:39)</a>:</h4>
<p>so that's what I tried to write, but failed - that's what I meant with <code>extern "C"</code> being "optional"</p>



<a name="147552803"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552803" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552803">(Nov 12 2018 at 21:39)</a>:</h4>
<p>mmh</p>



<a name="147552806"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552806" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552806">(Nov 12 2018 at 21:40)</a>:</h4>
<p>importing symbols written in another language may not be universally supported, defining a rust function with a different ABI can work just fine (as a nop)</p>



<a name="147552851"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552851" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552851">(Nov 12 2018 at 21:40)</a>:</h4>
<p>we should explicitly discuss subsetting Rust</p>



<a name="147552855"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552855" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552855">(Nov 12 2018 at 21:40)</a>:</h4>
<p>I would add it to unresolved questions</p>



<a name="147552857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552857">(Nov 12 2018 at 21:40)</a>:</h4>
<p>So I'm going to add an unresolved question about what to do about targets with a C implementation that's not standard conforming.</p>



<a name="147552867"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552867" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552867">(Nov 12 2018 at 21:40)</a>:</h4>
<p>I'm going to add another unresolved question about targets that do not have a C-like implementation at all (if they exist).</p>



<a name="147552869"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552869" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552869">(Nov 12 2018 at 21:40)</a>:</h4>
<p>I kinda want to see how the C++ standards committee is going to deal with it.</p>



<a name="147552889"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552889" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552889">(Nov 12 2018 at 21:41)</a>:</h4>
<p>and importing external symbols can just fall entirely under implementation-defined (i don't want to talk about GNU ld in a language spec) and on an interpreter implementation that impl-defined behavior is just "we never find that symbol"</p>



<a name="147552943"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552943" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552943">(Nov 12 2018 at 21:42)</a>:</h4>
<p>The problem I see is that this is going in a direction that's too C-oriented. Most of my <code>extern "C"</code> code is actually not written in C and so C standard conformance and related things are far away from being relevant.</p>



<a name="147552956"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552956" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552956">(Nov 12 2018 at 21:43)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> are you writing your <code>extern "C"</code> code in Rust, or C++?</p>



<a name="147552966"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552966" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552966">(Nov 12 2018 at 21:43)</a>:</h4>
<blockquote>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> point that we only need the C standard pieces required for FFI makes sense to me.</p>
</blockquote>
<p>more generally almost everything related to ABIs is outside the C language spec, even basic things like how integers are represented concretely in memory is more up to the architecture and implementation choices than (say) future C revisions specifying that ints appear to work as two's complement when cast to unsigned. so in some sense it's kind weird to bring in C-the-language at all</p>



<a name="147552968"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552968" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552968">(Nov 12 2018 at 21:43)</a>:</h4>
<p>Rust, assembly language, and another language that I can't talk about.</p>



<a name="147552970"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147552970" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147552970">(Nov 12 2018 at 21:44)</a>:</h4>
<p>but unfortunately all those platform documents are written in terms of the C type system</p>



<a name="147553010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553010">(Nov 12 2018 at 21:44)</a>:</h4>
<p>dangit, don't say things like that, that's super fascinating :P</p>



<a name="147553013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553013">(Nov 12 2018 at 21:44)</a>:</h4>
<p>Right, and I think it makes sense to document the requirements on the C type system, but not bring in the whole C17 standard.</p>



<a name="147553024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553024">(Nov 12 2018 at 21:45)</a>:</h4>
<p>There is probably one or a few small sections that list requirements on data types that are relevant and not subsumed by the ABI documentation, and I think it would be OK to reference them.</p>



<a name="147553028"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553028" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553028">(Nov 12 2018 at 21:45)</a>:</h4>
<p>so you'd want to say e.g. Rust f32 corresponds to C float where it exists and conforms to IEEE 754-2008?</p>



<a name="147553080"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553080" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553080">(Nov 12 2018 at 21:46)</a>:</h4>
<p>First, I don't know if Rust f32 is defined to be IEEE 754-2008, or if it is defined to be "whatever the ABI says 32-bit floats are" or something else.</p>



<a name="147553090"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553090" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553090">(Nov 12 2018 at 21:46)</a>:</h4>
<p>If f32 is defined to be IEEE 754-2008 then I would say that using f32 in a FFI declaration should be rejected on a platform that doesn't have IEEE 754-2008  floats.</p>



<a name="147553096"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553096" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553096">(Nov 12 2018 at 21:46)</a>:</h4>
<p>Maybe that means all such platforms would be rejected, or just those specific FFI declraations would be rejected.</p>



<a name="147553119"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553119" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553119">(Nov 12 2018 at 21:47)</a>:</h4>
<p>Similarly, we don't need to necessarily reject all platforms/ABIs where Bool isn't uint8_t 0/1. Just, we need to reject programs that make that assumption, e.g. by using <code>bool</code> in FFI contexts.</p>



<a name="147553180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553180">(Nov 12 2018 at 21:48)</a>:</h4>
<p>We would need to encode that in our target description files, but that should be doable.</p>



<a name="147553200"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553200" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553200">(Nov 12 2018 at 21:48)</a>:</h4>
<p>We could say that such platforms are not supported, yet, and doing these things is currently UB, and file issues to get the compiler to reject mismatches in some way, which maybe isn't even a high priority.</p>



<a name="147553206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553206">(Nov 12 2018 at 21:49)</a>:</h4>
<p>We could expose a <code>c_bool</code>, <code>c_float</code>, etc. in those platforms, if we wanted to somehow interface with them at that level.</p>



<a name="147553217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553217">(Nov 12 2018 at 21:49)</a>:</h4>
<p>Well, I think people don't want to standardize <code>c_bool</code>, <code>c_float</code>, etc.</p>



<a name="147553221"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553221" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553221">(Nov 12 2018 at 21:49)</a>:</h4>
<p>the relevant team decisions have been explicitly motivated by "we don't want people to have/desire to define and use c_bool etc."</p>



<a name="147553222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553222">(Nov 12 2018 at 21:49)</a>:</h4>
<p>An alternative is that we wouldn't call FFI in those platforms <code>extern "C"</code></p>



<a name="147553274"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553274" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553274">(Nov 12 2018 at 21:50)</a>:</h4>
<p>but <code>extern "something-else"</code></p>



<a name="147553305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553305">(Nov 12 2018 at 21:51)</a>:</h4>
<p>I do think "C" is a bad name which is why I don't include <code>"C"</code> in my <code>extern</code> declarations.</p>



<a name="147553309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553309">(Nov 12 2018 at 21:51)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> I think one problem we have is that we haven't fully decided what FFI safety means.</p>



<a name="147553315"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553315" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553315">(Nov 12 2018 at 21:51)</a>:</h4>
<p>i think either of those options (declare core types not FFI-safe on some weird platforms, or make a core ABI string unavailable on some weird platforms) would be big enough for RFC territory</p>



<a name="147553335"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553335" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553335">(Nov 12 2018 at 21:51)</a>:</h4>
<p>All FFI is unsound, therefore, unsafe, is not false, but is not a very useful way to work things out.</p>



<a name="147553336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553336">(Nov 12 2018 at 21:52)</a>:</h4>
<p>Oh, I'm aware. Since I'm programming in languages that are safer than Rust, it's actually ridiculous that I have to use <code>unsafe</code> to use that code!</p>



<a name="147553434"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553434" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553434">(Nov 12 2018 at 21:53)</a>:</h4>
<p>But, I think the fact is that <code>extern { }</code> ≡ <code>extern "C" {}</code>is something that will be hard to change and so it makes sense to write this document assume that that is the case.</p>



<a name="147553440"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553440" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553440">(Nov 12 2018 at 21:53)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> this PR is not an RFC - it is a summary about some things that had some consensus. It is obvious that there isn't full consensus about these things. Also, there are many unresolved questions as everybody can see.</p>



<a name="147553517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553517">(Nov 12 2018 at 21:54)</a>:</h4>
<p>And, similarly, I think that <code>extern "C"</code> == platform ABI is currently well-established.</p>



<a name="147553532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553532">(Nov 12 2018 at 21:55)</a>:</h4>
<p>yeah what i'm saying is, maybe don't get too carried away mapping out either option, let's focus on clarifying the things that can be clarified with relative ease</p>



<a name="147553564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553564">(Nov 12 2018 at 21:55)</a>:</h4>
<p>I think what's described at <a href="https://gankro.github.io/blah/rust-layouts-and-abis/" target="_blank" title="https://gankro.github.io/blah/rust-layouts-and-abis/">https://gankro.github.io/blah/rust-layouts-and-abis/</a> is basically what's true today.</p>



<a name="147553615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553615">(Nov 12 2018 at 21:56)</a>:</h4>
<p>as I recall some of that is only de-facto-true, not backed by any documentation or decisions</p>



<a name="147553628"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553628" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553628">(Nov 12 2018 at 21:56)</a>:</h4>
<p>Do we want people to be able to write unsafe code that relies forever on anything about that document being always true?</p>



<a name="147553664"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553664" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553664">(Nov 12 2018 at 21:57)</a>:</h4>
<p>My understanding is that if the target conforms to what that document says, things work today, perhaps accidentally.</p>



<a name="147553707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553707">(Nov 12 2018 at 21:58)</a>:</h4>
<p>Now, what's promised vs. what accidentally works is a fine distinction.</p>



<a name="147553711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553711">(Nov 12 2018 at 21:58)</a>:</h4>
<p>The point of the unsafe-code-guidelines is to come up with guidelines that unsafe code can rely on.</p>



<a name="147553722"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553722" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553722">(Nov 12 2018 at 21:58)</a>:</h4>
<p>So it works today is not good enough, it has to be "it will work always forever".</p>



<a name="147553748"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553748" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553748">(Nov 12 2018 at 21:59)</a>:</h4>
<p>This reduces the amount of the things that we can guarantee, because we don't know whether many things will always work forever.</p>



<a name="147553769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553769">(Nov 12 2018 at 21:59)</a>:</h4>
<p>So <code>CHAR_BITS == 8</code> for example, seems uncontroversial.</p>



<a name="147553777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553777">(Nov 12 2018 at 21:59)</a>:</h4>
<p>I am fine with abandonning claims made in my document, but only with sufficient motivation -- e.g. concrete platforms that we are interested in supporting, that those guarantees would prevent or otherwise hinder</p>



<a name="147553861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553861">(Nov 12 2018 at 22:00)</a>:</h4>
<p>But <span class="user-mention" data-user-id="133214">@Brian Smith</span>  suggested that <code>false = 0</code> and <code>true = 1</code> should not prevent interfacing with C FFI, but instead, should prevent using <code>bool</code> in FFI.</p>



<a name="147553883"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553883" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553883">(Nov 12 2018 at 22:00)</a>:</h4>
<p>And that is not a crazy idea. There might be different levels of things that we can require here.</p>



<a name="147553886"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553886" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553886">(Nov 12 2018 at 22:00)</a>:</h4>
<p>I think that's a reasonable tact to take</p>



<a name="147553894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553894">(Nov 12 2018 at 22:01)</a>:</h4>
<p>One way forward is to say "if all these are true then the platform is fully supported; if these are not true then it's still up in the air."</p>



<a name="147553899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553899">(Nov 12 2018 at 22:01)</a>:</h4>
<p>Maybe choosing "C FFI: all or nothing" is the wrong thing to do.</p>



<a name="147553905"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553905" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553905">(Nov 12 2018 at 22:01)</a>:</h4>
<p>doesn't C++17 require false = 0, true = 1?</p>



<a name="147553910"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553910" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553910">(Nov 12 2018 at 22:01)</a>:</h4>
<p>or maybe C++20 will?</p>



<a name="147553916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553916">(Nov 12 2018 at 22:01)</a>:</h4>
<p>maybe</p>



<a name="147553929"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553929" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553929">(Nov 12 2018 at 22:01)</a>:</h4>
<p>C++ requires false = 0, true = 1 for a long time.</p>



<a name="147553962"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553962" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553962">(Nov 12 2018 at 22:02)</a>:</h4>
<p>But what matters is what the ABI requires.</p>



<a name="147553981"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553981" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553981">(Nov 12 2018 at 22:02)</a>:</h4>
<p>my question about any such language standard guarantee is: what does that mean exactly and how does it rule out weird ABIs that store the value differently in RAM but fiddle with all operations on it to make it appear as such?</p>



<a name="147553982"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553982" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553982">(Nov 12 2018 at 22:02)</a>:</h4>
<p>JF Bastien's work is intended to define 0 and 1 for C++20, and C-next is also interested in adopting it</p>



<a name="147553985"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147553985" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147553985">(Nov 12 2018 at 22:02)</a>:</h4>
<p>But maybe we can say, <code>#[repr(C)]</code> structs are usable in C FFI _iff_ the platform implementation does things like this and like that, and if not, you can't use structs, but you can still use <code>bool</code>.</p>



<a name="147554022"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554022" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554022">(Nov 12 2018 at 22:03)</a>:</h4>
<p>or in other words, instead of a the platform document, we add a <code>bool</code> document, and <code>u8</code> document, etc. and specify when they are usable in extern functions</p>



<a name="147554090"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554090" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554090">(Nov 12 2018 at 22:04)</a>:</h4>
<p><span class="user-mention" data-user-id="137587">@Gankro</span> I think <span class="user-mention" data-user-id="133214">@Brian Smith</span> point remains. If you have a platform that defines <code>true = 42</code>, and you want to interface with C without using <code>bool</code>, or you just want to interface with assembly using <code>extern C</code>, should you be able to do that at all?</p>



<a name="147554094"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554094" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554094">(Nov 12 2018 at 22:04)</a>:</h4>
<p>IDK if it is worth the effort to even decide what to do for those platforms.</p>



<a name="147554100"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554100" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554100">(Nov 12 2018 at 22:05)</a>:</h4>
<p>I would rather start with an all-or-nothing approach with room to adopt a more fine-grain "oh you used bool sorry we don't support that here" later</p>



<a name="147554111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554111">(Nov 12 2018 at 22:05)</a>:</h4>
<blockquote>
<p>or in other words, instead of a the platform document, we add a <code>bool</code> document, and <code>u8</code> document, etc. and specify when they are usable in extern functions</p>
</blockquote>
<p>again i don't think any such effort would be in scope for the current guidelines, if we want to avoid implying anything about C platforms that violate some of our more controversial assumptions we should just include a paragraph to that effect</p>



<a name="147554115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554115">(Nov 12 2018 at 22:05)</a>:</h4>
<p>Basically I don't like spec boogeymen that create weird cargo-cult portability legends</p>



<a name="147554168"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554168" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554168">(Nov 12 2018 at 22:06)</a>:</h4>
<p>If the platform ABI conforms to @Gankro's document's requirements (possibly with some edits), then the platform can be supported and FFI will work. Otherwise, UB; in the future, we'll try to improve from UB to some documented state.</p>



<a name="147554176"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554176" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554176">(Nov 12 2018 at 22:06)</a>:</h4>
<p>yes, that sounds great</p>



<a name="147554180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554180">(Nov 12 2018 at 22:06)</a>:</h4>
<p>yeah something like that</p>



<a name="147554184"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554184" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554184">(Nov 12 2018 at 22:06)</a>:</h4>
<p>The fact is that there are no ports to platforms that don't conform to these requirements, so nobodywill be affected by the UB.</p>



<a name="147554193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554193">(Nov 12 2018 at 22:06)</a>:</h4>
<p>The "otherwise UB" sounds good, and is different than "the program is illegal" approach of the PR.</p>



<a name="147554199"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554199" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554199">(Nov 12 2018 at 22:07)</a>:</h4>
<p>So, the people who want to add support for such platforms can drive the future work to define what happens for such platforms, perhaps on a type-by-type basis.</p>



<a name="147554206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554206">(Nov 12 2018 at 22:07)</a>:</h4>
<p>If some implementation ever supports these, it can define what the UB does if it wants to.</p>



<a name="147554219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554219">(Nov 12 2018 at 22:07)</a>:</h4>
<p>But, now, does that actually solve the problem that this group is trying to solve?</p>



<a name="147554276"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554276" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554276">(Nov 12 2018 at 22:08)</a>:</h4>
<p>In particular, is this group trying to solve the problem of reading a <code>bool</code> from a <code>#[repr(C)]</code> struct through a non-bool reference or pointer like <code>*u8</code>?</p>



<a name="147554283"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554283" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554283">(Nov 12 2018 at 22:08)</a>:</h4>
<blockquote>
<p>If some implementation ever supports these, it can define what the UB does if it wants to.</p>
</blockquote>
<p>if that ever happens we should try to accomodate those implementations in the specs, but eh</p>



<a name="147554301"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554301" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554301">(Nov 12 2018 at 22:09)</a>:</h4>
<blockquote>
<p>In particular, is this group trying to solve the problem of reading a <code>bool</code> from a <code>#[repr(C)]</code> struct through a non-bool reference or pointer like <code>*u8</code>?</p>
</blockquote>
<p>yes definitely. and the answer appears to be: true = 1u8, false = 0u8</p>



<a name="147554306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554306">(Nov 12 2018 at 22:09)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> the question is, does this solve the problem for you?</p>



<a name="147554308"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554308" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554308">(Nov 12 2018 at 22:09)</a>:</h4>
<p>If the group is trying to define what happens when one reads a <code>bool</code> through a <code>*u8</code> then my suggestion doesn't work. But I would suggest we just shouldn't define that.</p>



<a name="147554309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554309">(Nov 12 2018 at 22:09)</a>:</h4>
<p>and this is just documenting existing practice and guarantees (in the case of bool)</p>



<a name="147554394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554394">(Nov 12 2018 at 22:10)</a>:</h4>
<p>If it is important to define what it means to read a bool through a <code>*u8</code> or whatever, then the only choices for supporting future platforms that don't conform to these rules are "don't ever support them" or "support the subset of the language that meets the rules."</p>



<a name="147554398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554398">(Nov 12 2018 at 22:11)</a>:</h4>
<p><a href="https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46/commits/25097ac72941d92db598764de8afefd706886297" target="_blank" title="https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46/commits/25097ac72941d92db598764de8afefd706886297">https://github.com/rust-rfcs/unsafe-code-guidelines/pull/46/commits/25097ac72941d92db598764de8afefd706886297</a></p>



<a name="147554416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554416">(Nov 12 2018 at 22:11)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> per the spec, the size of a bool and u8 are equal, and bool can only have two values true and false, which are represented as <code>0_u8</code> and <code>1_u8</code>.</p>



<a name="147554460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554460">(Nov 12 2018 at 22:12)</a>:</h4>
<p>You can read a bool through an <code>*u8</code> pointer, but if you construct a bool from an <code>u8</code> that is not 0 or 1, the behavior is undefined</p>



<a name="147554465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554465">(Nov 12 2018 at 22:12)</a>:</h4>
<p>Which spec?</p>



<a name="147554474"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554474" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554474">(Nov 12 2018 at 22:12)</a>:</h4>
<p>sorry, the unsafe code guidelines I mean</p>



<a name="147554482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554482">(Nov 12 2018 at 22:12)</a>:</h4>
<p>Anyway, the way the PR is written now, everything FFI is UB because no C implementations conform to C17.</p>



<a name="147554495"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554495" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554495">(Nov 12 2018 at 22:13)</a>:</h4>
<p>So, again, I'd like to replace that requirement with one more like Gankro's doc.</p>



<a name="147554588"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554588" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554588">(Nov 12 2018 at 22:15)</a>:</h4>
<p>The way it was written before it was all UB as well.</p>



<a name="147554615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554615">(Nov 12 2018 at 22:15)</a>:</h4>
<p>Right, I agree. But I think a doc like Gankro's gets us to a point where things are actually defined.</p>



<a name="147554618"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554618" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554618">(Nov 12 2018 at 22:15)</a>:</h4>
<p>We can't define anything about structs / enums / unions / .. here. Those go in their own chapters.</p>



<a name="147554676"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554676" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554676">(Nov 12 2018 at 22:16)</a>:</h4>
<p>bool ints and float should go in the integer and floating point chapter</p>



<a name="147554688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554688">(Nov 12 2018 at 22:16)</a>:</h4>
<p>so the only thing we could leave here is CHAR_BITS == 8</p>



<a name="147554697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554697">(Nov 12 2018 at 22:17)</a>:</h4>
<p>How about this: The C implementation must conform to the ABI requirements.</p>



<a name="147554712"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554712" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554712">(Nov 12 2018 at 22:17)</a>:</h4>
<p>Most ABI docs I've read, w.r.t. C, are just restrictions on the way C may be implemented.</p>



<a name="147554733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554733">(Nov 12 2018 at 22:18)</a>:</h4>
<p>Even more generally, anything that you want to use with <code>extern "C"</code> and <code>#[repr(C)]</code> must conform to the ABI, regardless of language.</p>



<a name="147554904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147554904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147554904">(Nov 12 2018 at 22:20)</a>:</h4>
<p>An alternative is to make this document a summary of the <code>repr(C)</code> issues that are resolved somewhere else.</p>



<a name="147555045"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555045" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555045">(Nov 12 2018 at 22:23)</a>:</h4>
<p>I am (very slowly) drafting an RFC for something I'm tentatively calling <code>extern "platform-abi" {}</code> which is mostly like <code>extern "C"</code> except you don't have to use <code>unsafe{}</code> to call such functions, so IMO defining the details of Rust's requirements on the ABI outside of the unsafe code guidelines would be ideal to me.</p>



<a name="147555234"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555234" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555234">(Nov 12 2018 at 22:26)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@Brian Smith</span> i've changed the PR completely, please take a look</p>



<a name="147555302"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555302" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555302">(Nov 12 2018 at 22:27)</a>:</h4>
<p>also as a meta comment I would suggest embracing redundancy and clarity over absolute modularity and precision. It is extremely painful to watch people try to divine semantic implications of C/C++ references by piecing together several disparate sections</p>



<a name="147555366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555366">(Nov 12 2018 at 22:28)</a>:</h4>
<p>If there is a thing you are trying to make work, having a section that says "hey this works" is ideal</p>



<a name="147555401"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555401" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555401">(Nov 12 2018 at 22:29)</a>:</h4>
<p>Plus, redundancy helps catch places where things were supposed to work but lead to contradictions</p>



<a name="147555472"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555472" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555472">(Nov 12 2018 at 22:30)</a>:</h4>
<p>(similarly, calling out things that explicitly don't work, and why, is very nice)</p>



<a name="147555474"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555474" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555474">(Nov 12 2018 at 22:30)</a>:</h4>
<p>Is it generally true that the appearance of any built-in data type has the same semantics regardless of <code>extern "C"</code> and regardless of <code>#[repr(C)]</code>?</p>



<a name="147555485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555485">(Nov 12 2018 at 22:30)</a>:</h4>
<p>I mean, isn't <code>bool</code> the same thing no matter where it is, from the Rust perspective?</p>



<a name="147555505"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555505" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555505">(Nov 12 2018 at 22:31)</a>:</h4>
<p>yes</p>



<a name="147555509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555509">(Nov 12 2018 at 22:31)</a>:</h4>
<p>(I've always mentally modeled the primitives as being marked repr(C))</p>



<a name="147555761"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147555761" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147555761">(Nov 12 2018 at 22:36)</a>:</h4>
<p>Going back to earlier suggestions here, I think it makes sense to talk about common interop issues w/ C, but perhaps that whole discussion should be non-normative, and like suggested above, should reference other documents (e.g.  how bool is defined in trust) for the normative requirements.</p>



<a name="147556598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556598">(Nov 12 2018 at 22:54)</a>:</h4>
<p>Oh also my document has a minor flaw, in that I say arrays have no kind (since they can't actually be passed), but you need to define the kind of arrays for things like the x64 ABI which does SROA-ish things to structs, which <em>can</em> contain arrays by-value</p>



<a name="147556718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556718">(Nov 12 2018 at 22:57)</a>:</h4>
<p>sadly I can't seem to find anything in the sysv spec that clearly explains how arrays are handled :s</p>



<a name="147556766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556766">(Nov 12 2018 at 22:58)</a>:</h4>
<p>cc <span class="user-mention" data-user-id="119009">@eddyb</span> ^</p>



<a name="147556795"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556795" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556795">(Nov 12 2018 at 22:58)</a>:</h4>
<p>aren't they treated as if</p>
<div class="codehilite"><pre><span></span><span class="k">struct</span> <span class="n">foo</span> <span class="p">{</span>
  <span class="n">T</span> <span class="n">a</span><span class="p">[</span><span class="n">N</span><span class="p">];</span>
<span class="p">};</span>
<span class="c1">// is equivalent to</span>
<span class="k">struct</span> <span class="n">foo</span> <span class="p">{</span>
  <span class="n">T</span> <span class="n">a₁</span><span class="p">;</span>
  <span class="n">T</span> <span class="n">a₂</span><span class="p">;</span>
  <span class="p">...</span>
  <span class="n">T</span> <span class="n">aₙ</span><span class="p">;</span>
<span class="p">};</span>
</pre></div>



<a name="147556846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556846">(Nov 12 2018 at 23:00)</a>:</h4>
<p>that would make perfect sense, and is what I'd expect, but I want to be sure :)</p>



<a name="147556896"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556896" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556896">(Nov 12 2018 at 23:00)</a>:</h4>
<p>I think that's correct, yeah</p>



<a name="147556909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556909">(Nov 12 2018 at 23:00)</a>:</h4>
<p>Err wait, it's splatted? Not a nested struct?</p>



<a name="147556922"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556922" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556922">(Nov 12 2018 at 23:00)</a>:</h4>
<p>SysV doesn't care about nesting</p>



<a name="147556925"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556925" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556925">(Nov 12 2018 at 23:00)</a>:</h4>
<p>I don't think so...</p>



<a name="147556928"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556928" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556928">(Nov 12 2018 at 23:01)</a>:</h4>
<p>yeah</p>



<a name="147556946"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556946" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556946">(Nov 12 2018 at 23:01)</a>:</h4>
<p>yeah I'm just not 100% certain nothing does</p>



<a name="147556952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556952">(Nov 12 2018 at 23:01)</a>:</h4>
<p>I have no counter-examples where it would matter</p>



<a name="147556954"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556954" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556954">(Nov 12 2018 at 23:01)</a>:</h4>
<p>sure, it's just not SysV</p>



<a name="147556959"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556959" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556959">(Nov 12 2018 at 23:01)</a>:</h4>
<p>heh <a href="https://github.com/rust-lang/rust/blob/master/src/librustc_target/abi/call/x86_64.rs#L68" target="_blank" title="https://github.com/rust-lang/rust/blob/master/src/librustc_target/abi/call/x86_64.rs#L68">https://github.com/rust-lang/rust/blob/master/src/librustc_target/abi/call/x86_64.rs#L68</a></p>



<a name="147556967"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556967" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556967">(Nov 12 2018 at 23:01)</a>:</h4>
<p>(this does the same thing for both structs and arrays)</p>



<a name="147556970"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147556970" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147556970">(Nov 12 2018 at 23:01)</a>:</h4>
<p>where what would matter?</p>



<a name="147557013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557013">(Nov 12 2018 at 23:02)</a>:</h4>
<p>arrays in particular? or struct nesting?</p>



<a name="147557032"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557032" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557032">(Nov 12 2018 at 23:02)</a>:</h4>
<p>mostly just being paranoid</p>



<a name="147557067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557067">(Nov 12 2018 at 23:03)</a>:</h4>
<p>a vague tingling in the back of my brain from the fact that we concluded we were "supposed" to emit an anonymous struct in the repr of tagged unions</p>



<a name="147557146"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557146" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557146">(Nov 12 2018 at 23:05)</a>:</h4>
<p>good ABIs don't care about C-isms like struct nesting, but sadly a lot of ABIs are defined in terms of C types, which can lead to some ridiculous behavior</p>



<a name="147557159"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557159" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557159">(Nov 12 2018 at 23:05)</a>:</h4>
<p>like the two that pass ZSTs by indirection</p>



<a name="147557207"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557207" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557207">(Nov 12 2018 at 23:06)</a>:</h4>
<p>or the sadness that is <code>#[repr(transparent)]</code> != <code>#[repr(C)]</code></p>



<a name="147557231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147557231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147557231">(Nov 12 2018 at 23:06)</a>:</h4>
<p>(AFAIK SysV doesn't make the distinction, which is, again, good)</p>



<a name="147576216"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147576216" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147576216">(Nov 13 2018 at 08:01)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> </p>
<blockquote>
<p>I am (very slowly) drafting an RFC for something I'm tentatively calling <code>extern "platform-abi" {}</code> which is mostly like <code>extern "C"</code> except you don't have to use <code>unsafe{}</code> to call such functions, so IMO defining the details of Rust's requirements on the ABI outside of the unsafe code guidelines would be ideal to me.</p>
</blockquote>
<p>Interesting. So does this have a typed linker, or how else does it make sure that the extern fn matches the signature? Not to mention all the other guarantees Rust has/might have for its types.<br>
TBH I am somewhat skeptical about weakening <code>unsafe</code> that much.</p>



<a name="147580299"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580299" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580299">(Nov 13 2018 at 09:47)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> <code>extern "C"</code> is not what makes calling those functions <code>unsafe</code></p>



<a name="147580300"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580300" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580300">(Nov 13 2018 at 09:47)</a>:</h4>
<p>it's orthogonal</p>



<a name="147580310"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580310" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580310">(Nov 13 2018 at 09:47)</a>:</h4>
<p>everything inside <code>extern "..." { ... }</code> is unsafe to access because Rust has no control over them</p>



<a name="147580374"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580374" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580374">(Nov 13 2018 at 09:48)</a>:</h4>
<p>if you want you can make a proc macro attribute that replaces an <code>extern {...}</code> "block"/"module" with individual (safe) functions that call through to the  FFI ones</p>



<a name="147580390"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580390" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580390">(Nov 13 2018 at 09:49)</a>:</h4>
<p>e.g. <code>#[safe_wrappers] extern "C" { fn foo(); ... }</code> -&gt; <code>fn foo() { extern "C" { fn foo(); } foo() } ...</code></p>



<a name="147580398"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147580398" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> eddyb <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147580398">(Nov 13 2018 at 09:49)</a>:</h4>
<p>a typed linker would be interesting but also significantly more work</p>



<a name="147598063"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147598063" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147598063">(Nov 13 2018 at 15:24)</a>:</h4>
<p>ironically we could make <code>unsafe extern fn</code> the syntax for making a safe extern fn</p>



<a name="147609507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147609507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147609507">(Nov 13 2018 at 17:24)</a>:</h4>
<p>@eddyb "safe wrappers" are already part of my explanation for why adding <code>unsafe extern fn</code> is better than what we have now. In my case, I'm using function pointers to call the functions and so <code>#[inline]</code> doesn't  optimize away the overhead.</p>



<a name="147610207"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147610207" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147610207">(Nov 13 2018 at 17:34)</a>:</h4>
<p><code>extern "C" fn()</code> is already a thing and you can call it safely. to get such a function pointer from external functions declared in an <code>extern "abi" {}</code> block you need to unsafely type pun the <code>unsafe</code> away, but that's what serves as the unchecked assertion that the function signatures really are correct as declared, there's no way around such an unchecked assertion (assuming you don't have typed linkers)</p>



<a name="147617206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147617206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147617206">(Nov 13 2018 at 19:02)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> The "safe wrapper" idea shows it doesn't matter.</p>



<a name="147617358"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147617358" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147617358">(Nov 13 2018 at 19:04)</a>:</h4>
<p>I think <span class="user-mention" data-user-id="137587">@Gankro</span>'s idea of putting <code>unsafe</code> in the <code>extern fn</code> declaration to indicate that something isn't being checked is actually a huge improvement over safe wrappers, and the safe wrappers already work today.</p>



<a name="147617560"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147617560" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147617560">(Nov 13 2018 at 19:07)</a>:</h4>
<p>I don't follow at all. When you write <code>extern "whatever" { fn foo(i32) -&gt; i32; }</code>, there's no way for rustc to ensure that the symbol <code>foo</code> actually refers to a function of that signature, and if it doesn't and it's called, memory safety goes down the drain. that's why calling it has to be unsafe -- for soundness of safe rust.</p>



<a name="147618057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618057">(Nov 13 2018 at 19:15)</a>:</h4>
<p>Rust already lets you call <code>foo(x)</code> without using <code>unsafe</code>; you just have to create a "safe wrapper" that obfuscates the fact that an extern function is being called.</p>



<a name="147618085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618085">(Nov 13 2018 at 19:15)</a>:</h4>
<p>that safe wrapper contains an unsafe block. that unsafe block serves as the programmer's assertion that the imported function is safe to call.</p>



<a name="147618146"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618146" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618146">(Nov 13 2018 at 19:16)</a>:</h4>
<p>Right, and <code>unsafe extern</code> would serve the same purpose.</p>



<a name="147618158"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618158" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618158">(Nov 13 2018 at 19:16)</a>:</h4>
<p>Excactly the same amount of <code>unsafe</code> but without the overhead.</p>



<a name="147618161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618161">(Nov 13 2018 at 19:16)</a>:</h4>
<p>Ok I see where this is going now</p>



<a name="147618258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618258">(Nov 13 2018 at 19:18)</a>:</h4>
<p>This choice of syntax would be quite unfortunate because <code>unsafe</code> on function declarations means something different from unsafe blocks (has proof obligations vs claiming those are met). this is a pre-existing problem but this would exacerbate the problem because it looks a lot like <code>unsafe fn</code> but that's exactly the wrong way around.</p>



<a name="147618466"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618466" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618466">(Nov 13 2018 at 19:21)</a>:</h4>
<p>Yes, that's a good point too. I think some people will insist that <code>unsafe</code> has to appear in there, following your argument above, but maybe it doesn't have to appear as <code>unsafe extern</code> or <code>extern unsafe fn</code> but somewhere else.</p>



<a name="147618485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618485">(Nov 13 2018 at 19:21)</a>:</h4>
<p>The weirdness is already there with <code>unsafe impl</code>, isn't it?</p>



<a name="147618588"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618588" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618588">(Nov 13 2018 at 19:22)</a>:</h4>
<p>unsafe impl at least naturally mirrors unsafe trait, and if i had to choose then i would pair up trait {decl, impl} with function {decl, call} as "trait impl ~ fn call and trait decl ~ function decl"</p>



<a name="147618611"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147618611" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147618611">(Nov 13 2018 at 19:23)</a>:</h4>
<p>but also yeah as I said this is not a new problem, I just want to avoid making it even worse</p>



<a name="147619824"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147619824" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147619824">(Nov 13 2018 at 19:43)</a>:</h4>
<p>One option would be to put the <code>unsafe</code> in <code>#[link(unsafe)]</code> and then allow calling any <code>extern</code> function without <code>unsafe {}</code> if it has such an attribute, unless it is also marked <code>unsafe extern</code>. This would make the syntax consistent and also would call out the unsafety lies in the linking.</p>



<a name="147625262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147625262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147625262">(Nov 13 2018 at 21:04)</a>:</h4>
<p>why not something like</p>
<div class="codehilite"><pre><span></span><span class="k">unsafe</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>



<a name="147626913"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147626913" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147626913">(Nov 13 2018 at 21:31)</a>:</h4>
<p><span class="user-mention" data-user-id="125253">@Nicole Mazzuca</span> I'm not sure if you can see the conversation beforehand, but people expressed some concern that <code>unsafe extern fn</code> would mean the opposite of <code>unsafe fn</code> which is wierd.</p>



<a name="147627419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147627419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147627419">(Nov 13 2018 at 21:39)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> </p>
<div class="codehilite"><pre><span></span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo1</span><span class="p">()</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">fn</span> <span class="nf">bar1</span><span class="p">();</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">unsafe</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo2</span><span class="p">()</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="k">unsafe</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">fn</span> <span class="nf">bar2</span><span class="p">();</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span>: <span class="nc">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span><span class="p">()</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">foo1</span><span class="p">;</span><span class="w"></span>
<span class="w">  </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span>: <span class="nc">unsafe</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span><span class="p">()</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">foo2</span><span class="p">;</span><span class="w"></span>

<span class="w">  </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span>: <span class="nc">unsafe</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span><span class="p">()</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">bar1</span><span class="p">;</span><span class="w"></span>
<span class="w">  </span><span class="kd">let</span><span class="w"> </span><span class="n">_</span><span class="w"> </span>: <span class="nc">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span><span class="p">()</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">bar2</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="147627483"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147627483" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147627483">(Nov 13 2018 at 21:40)</a>:</h4>
<p>this is, without bar2, how the typing rules work today</p>



<a name="147627493"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147627493" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147627493">(Nov 13 2018 at 21:40)</a>:</h4>
<p>bar2 is my suggestion</p>



<a name="147655280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147655280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147655280">(Nov 14 2018 at 09:01)</a>:</h4>
<blockquote>
<p>This choice of syntax would be quite unfortunate because <code>unsafe</code> on function declarations means something different from unsafe blocks (has proof obligations vs claiming those are met). this is a pre-existing problem but this would exacerbate the problem because it looks a lot like <code>unsafe fn</code> but that's exactly the wrong way around.</p>
</blockquote>
<p>Shameless plug: Have you seen <a href="https://github.com/rust-lang/rfcs/pull/2585" target="_blank" title="https://github.com/rust-lang/rfcs/pull/2585">https://github.com/rust-lang/rfcs/pull/2585</a> ?</p>



<a name="147656284"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147656284" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147656284">(Nov 14 2018 at 09:24)</a>:</h4>
<p>I have, and I would have loved that change pre-1.0, but idk how to do it now without excessive churn so I didn't say anything instead of repeating what others have said on the issue</p>



<a name="147688924"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147688924" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147688924">(Nov 14 2018 at 18:25)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> This doesn't make sense to me. <code>unsafe extern fn</code> is _absolutely_ not what I'm suggesting, because <code>unsafe extern fn</code> already has a meaning - define a function with extern ABI, which is unsafe</p>



<a name="147688935"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147688935" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147688935">(Nov 14 2018 at 18:25)</a>:</h4>
<p>what I'm suggesting is <code>unsafe extern "C" { ... }</code></p>



<a name="147688986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147688986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147688986">(Nov 14 2018 at 18:26)</a>:</h4>
<p>note: _not on the function declaration_</p>



<a name="147730225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147730225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147730225">(Nov 15 2018 at 09:26)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> how bad is the problem of having to write a safe thin wrapper about a <code>unsafe</code> extern C function is ? is it a problem worth solving at all? Is it worth solving it right now? even if it was, I don't think the <code>unsafe-code-guidelines</code> are the place to solve it (an RFC repo issue would probably be the place to start supposing I understood the issue correcty: allowing a way to declare <code>extern "C"</code> functions that are safe to call)</p>



<a name="147850382"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/147850382" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#147850382">(Nov 16 2018 at 22:23)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> It isn't the worst or most urgent problem I'm facing, TBH. I will revisit it after I deal with other things.</p>



<a name="150736378"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150736378" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150736378">(Dec 02 2018 at 20:59)</a>:</h4>
<p>I started writing a <code>no_mangle</code> function and then I realized that, based on the above discussion, the way <code>no_mangle</code> works doesn't make sense. It turns out this is a known issue: <a href="https://github.com/rust-lang/rust/issues/28179" target="_blank" title="https://github.com/rust-lang/rust/issues/28179">https://github.com/rust-lang/rust/issues/28179</a>. So there's a strong inconsistency in terms of whether calling a function with unsafe linkage requires <code>unsafe</code>.  This also suggests a workaround: For every "safe extern" function, define an equivalent <code>#[no_mangle] #[inline(never)]</code> Rust function with body <code>{ unimplemented!() }</code>; then, during linking, coerce the linker into choosing the non-Rust implementation.</p>



<a name="150736513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150736513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150736513">(Dec 02 2018 at 21:02)</a>:</h4>
<p>This hack (proposed mostly tongue-in-cheek) wouldn't "solve" all my FFI optimization issues, though; Ideally I'd be  able to implement a (safe) trait method with code written in a language which is safer than Rust.</p>



<a name="150794877"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150794877" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150794877">(Dec 03 2018 at 19:44)</a>:</h4>
<p>"safety" is certainly not a total order</p>



<a name="150794899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150794899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150794899">(Dec 03 2018 at 19:45)</a>:</h4>
<p>and given that it is a contextual property, it might not be an order at all...</p>



<a name="150794912"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150794912" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150794912">(Dec 03 2018 at 19:45)</a>:</h4>
<p>so "safer than Rust" I don't think helps here</p>



<a name="150794936"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150794936" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150794936">(Dec 03 2018 at 19:45)</a>:</h4>
<p>e.g. if you implement a higher-order function in Java, that one is safe there but it also can assume that all the functions it gets are Java functions, so even if Java was "safer than Rust" you still couldnt safely call this function from Rust</p>



<a name="150794992"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150794992" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150794992">(Dec 03 2018 at 19:46)</a>:</h4>
<p>it might work for first-order functions though? but only if the guarantees actually align. seems like a very special case to me.</p>



<a name="150795123"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150795123" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150795123">(Dec 03 2018 at 19:48)</a>:</h4>
<p>oh I love this one :D</p>
<div class="codehilite"><pre><span></span><span class="cp">#[no_mangle]</span><span class="w"></span>
<span class="cp">#[allow(non_snake_case)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">_ZN2io5stdio6_print20h94cd0587c9a534faX3gE</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">unreachable</span><span class="o">!</span><span class="p">()</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="150795281"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150795281" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150795281">(Dec 03 2018 at 19:50)</a>:</h4>
<p>oh this is even better</p>
<div class="codehilite"><pre><span></span><span class="cp">#![no_main]</span><span class="w"></span>

<span class="cp">#[link_section=</span><span class="s">&quot;.text&quot;</span><span class="cp">]</span><span class="w"></span>
<span class="cp">#[no_mangle]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">static</span><span class="w"> </span><span class="n">main</span>: <span class="p">[</span><span class="kt">u32</span><span class="p">;</span><span class="w"> </span><span class="mi">9</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">[</span><span class="w"></span>
<span class="w">    </span><span class="mi">3237986353</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">3355442993</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">120950088</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">822083584</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">252621522</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">1699267333</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">745499756</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">1919899424</span><span class="p">,</span><span class="w"></span>
<span class="w">    </span><span class="mi">169960556</span><span class="p">,</span><span class="w"></span>
<span class="p">];</span><span class="w"></span>
</pre></div>



<a name="150889490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150889490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150889490">(Dec 04 2018 at 23:45)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> By "safer than Rust" I mean a language that makes the same memory safety guarantees as Rust and also provides guarantees not provided by Rust. For example, I would consider Coq to be "safer than Rust" since you can prove your code correct.</p>



<a name="150889590"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150889590" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150889590">(Dec 04 2018 at 23:46)</a>:</h4>
<p>My point is that either we need to fix <code>#[no_mangle]</code> to make it safe (at least) or we shouldn't reject "safe extern" just because the linkage is unsafe.</p>



<a name="150925932"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150925932" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150925932">(Dec 05 2018 at 13:05)</a>:</h4>
<p>Why is fixing <code>#[no_mangle]</code> hard ?</p>



<a name="150960128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150960128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150960128">(Dec 05 2018 at 20:57)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> It's in the issue: <a href="https://github.com/rust-lang/rust/issues/28179" target="_blank" title="https://github.com/rust-lang/rust/issues/28179">https://github.com/rust-lang/rust/issues/28179</a>. Basically fixing it is a breaking change.</p>



<a name="150966483"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966483" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966483">(Dec 05 2018 at 22:28)</a>:</h4>
<p>I don't think that a safe <code>#[no_mangle]</code> is a desirable end-state</p>



<a name="150966503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966503">(Dec 05 2018 at 22:28)</a>:</h4>
<p>the compiler would have to know the effects of all "special" functions</p>



<a name="150966507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966507">(Dec 05 2018 at 22:28)</a>:</h4>
<p>and of course, other code might look them up</p>



<a name="150966537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966537">(Dec 05 2018 at 22:29)</a>:</h4>
<p>the point of <code>#[no_mangle]</code> is to allow you to interact with the external world. If you wrongly interact with the external world, that can be very easily be UB.</p>



<a name="150966546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966546">(Dec 05 2018 at 22:29)</a>:</h4>
<p>(e.g., consider a C library you are using that has some random symbol with weak linkage)</p>



<a name="150966551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966551">(Dec 05 2018 at 22:29)</a>:</h4>
<p>(and expects it to have a particular type/invariants/whatever)</p>



<a name="150966616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150966616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ariel Ben-Yehuda <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150966616">(Dec 05 2018 at 22:30)</a>:</h4>
<p>I think the best option is just forbidding all the "FFI attributes" in <code>#[forbid(unsafe_code)]</code></p>



<a name="150990921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150990921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150990921">(Dec 06 2018 at 08:31)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> we can start by adding a warning like we did for references to packed struct fields</p>



<a name="150990972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi%20safety/near/150990972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/ffi.20safety.html#150990972">(Dec 06 2018 at 08:32)</a>:</h4>
<p>and your suggestions in the issue look fine to me too</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>